Loading vulnerability…
Denial of Service in GitLab EE GraphQL SBOM API
CVE-2026-1101 is a denial-of-service vulnerability in GitLab Enterprise Edition affecting the GraphQL SBOM API. The flaw is caused by improper input validation in GraphQL queries, allowing a crafted authenticated request to trigger excessive resource consumption or otherwise destabilize request processing. The issue affects GitLab EE versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause denial of service of the GitLab instance. An authenticated attacker can disrupt availability of the affected service, potentially degrading or interrupting normal operation for users of the instance.
If you can’t patch tonight, do this now.
No specific workaround is available from the provided information beyond applying the vendor patch. Where immediate upgrade is not possible, reducing exposure of the affected GraphQL SBOM functionality to only necessary authenticated users and monitoring for abusive GraphQL request patterns may reduce risk, but this does not remediate the vulnerability.
Patch, then assume compromise.
Upgrade GitLab EE to a fixed release. Patched versions are 18.8.9, 18.9.5, and 18.10.3 or later within the supported release trains. GitLab advised self-managed customers to upgrade immediately.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.